PT-2025-38249

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.10 Description: A vulnerability exists in Portabilis i-Educar up to version 2.10. The issue involves improper access controls due to manipulation of an unknown function within the /enrollment-history/ file...

SUSE CVE-2023-53300

In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846initcontrols hi846initcontrols doesn't clean the allocated ctrlhdlr in case there is a failure, which causes memleak. Add v4l2ctrlhandlerfree to free the resource properly...

CVE-2023-53300

In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846initcontrols hi846initcontrols doesn't clean the allocated ctrlhdlr in case there is a failure, which causes memleak. Add v4l2ctrlhandlerfree to free the resource properly...

DEBIAN-CVE-2023-53300

In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846initcontrols hi846initcontrols doesn't clean the allocated ctrlhdlr in case there is a failure, which causes memleak. Add v4l2ctrlhandlerfree to free the resource properly...

CVE-2023-53300

The CVE-2023-53300 issue is in the Linux kernel media hi846 driver: hi846_init_controls allocated a ctrl_hdlr but failed to free it on error, causing a memory leak. The fix adds v4l2_ctrl_handler_free to properly release the allocated resources when initialization fails. Affected area: kernel med...

PT-2025-37917

Name of the Vulnerable Software and Affected Versions: Sparkle framework versions prior to 2.7.2 Description: The Sparkle framework includes an XPC service, Downloader.xpc, which is, by default, private to the application it is bundled with. A local, unprivileged attacker can register this XPC...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parser process. An attacker can cause excessive memory consumption by submitting a specially crafted XML document, resulting in service disruption due to resource exhaustion...

CVE-2025-58065

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

CVE-2025-10247

A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-10269 Spirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion

The Spirit Framework plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the executi...

CVE-2025-58065

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

GHSA-765J-9R45-W2Q2 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create...

UBUNTU-CVE-2025-48039

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh sshsftp modules allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/sshsftpd.erl. This issue affects OTP from OTP 17.0 before OTP 28.0.3,...

PT-2025-39636

Name of the Vulnerable Software and Affected Versions versions prior to 2.3 Description A flaw exists in the live query subscription mechanism of the database engine. This allows record or guest users to observe unauthorized records within the same table, bypassing access controls. This is achiev...

CVE-2025-20159 Cisco IOS XR Software Management Interface ACL Bypass Vulnerability

A vulnerability in the management interface access control list ACL processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features. This vulnerability exists because management interface ACLs have not...

CVE-2025-10071

A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may b...

CVE-2025-10070

A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used...

Schneider Electric Altivar Products, ATVdPAC Module, ILC992 InterLink Converter (Update B)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

You Didn't Get Phished — You Onboarded the Attacker

When Attackers Get Hired: Today's New Identity Crisis What if the star engineer you just hired isn't actually an employee, but an attacker in disguise? This isn't phishing; it's infiltration by onboarding. Meet "Jordan from Colorado," who has a strong resume, convincing references, a clean...

PT-2025-36462

CVE ID: CVE-2025-0005 Published: 2025-05-20T00:00:00.000Z Severity: HIGH 7.5/10 Description Information disclosure vulnerability in the API Gateway v7.2.0 allows unauthenticated remote attackers to access sensitive information via a crafted HTTP request. Root Cause Improper access control in API...